Tenant isolation, a tamper-evident audit chain, MFA, encrypted backups, regional data residency, AI that never trains on your data, a SOC 2 roadmap, and single-tenant / on-prem on Enterprise by arrangement. We publish how each one works so you can verify it — not just trust it.
Every table that holds tenant data is scoped by RLS policies enforced inside Postgres — not at the application layer. We use FORCE ROW LEVEL SECURITY so even the table owner cannot accidentally bypass the policy. Per-tenant storage buckets and signed-URL access prevent cross-tenant reads from object storage.
Every signable artefact — log, lab result, certificate, report, signature — is hashed with SHA-256 and chained to the previous record by a database trigger that you cannot opt out of. Tampering with any historical record breaks the chain. The chain is re-verifiable from a CSV export, so you do not have to trust our hosting to trust the audit.
Time-based one-time-password authentication is supported for every user and is enforced for the Director and Owner roles. Recovery codes are issued on enrolment and stored encrypted at rest. We do not support SMS-based MFA — the risk is real and the cost is unwarranted.
All AI inference runs on AWS Bedrock inside the tenant’s designated AWS region. Customer data does not leave the AWS region. The Bedrock foundation models we use — for reasoning, photo classification, and fast-tier checks — are explicitly not trained on customer data. We do not use Anthropic, OpenAI, or GPT family models in any user-facing AI path.
You own every borehole, lab result, model, and report you put into TerraBrains. Export the lot at any time — AGS 4.x, DIGGS 2.x, CSV, every report PDF, every photo, and the audit-chain hashes — from Settings → Data. We never sell your data, never share it, and never use your proprietary borehole models or reports to train any AI. If you leave, you take everything; we retain it for 90 days for your convenience, then delete it.
All traffic is TLS 1.2+ end to end. Data at rest — Postgres, object storage, and backups — is encrypted with AES-256 by the managed cloud layer. Secrets and signing keys are held in managed secret stores, never in source. Single-use, time-boxed signed URLs gate every file read.
The database is backed up automatically every day with point-in-time recovery, so we can restore to any moment within the retention window. Object storage is redundantly stored across availability zones. The audit chain means a restore is independently verifiable — you can prove the recovered data is the data you signed.
Tenant data and all AI inference are pinned to your designated cloud region — including India (Mumbai) for firms with data-localisation obligations on national-infrastructure work. Customer data does not leave the chosen region for processing.
Our controls — access management, encryption, change management, logging, vendor review — are built to the SOC 2 Trust Services Criteria, and a Type II report is on the roadmap (in progress, not yet certified — we will not claim otherwise). A Data Processing Agreement is available today for any paying organisation. Regional data residency and tax-compliant invoicing support local procurement wherever you operate.
We use a small, deliberate set of sub-processors: AWS (compute, Bedrock AI, storage), Supabase (managed Postgres + auth), Vercel (web delivery), Dodo Payments (merchant-of-record billing and tax — it handles worldwide payments, currency and tax), and Resend (transactional email). Each is a reputable provider with its own published security posture. We notify customers before adding a new sub-processor that touches tenant data.
Firms handling sensitive national-infrastructure data (dams, metros, nuclear, defence) often cannot place data in a vendor cloud. On the Enterprise tier we deliver a dedicated single-tenant deployment, or a full on-prem deployment into your own cloud account — same software, your perimeter, your keys — as a scoped part of the contract. A self-service on-prem kit is on our roadmap; today it is delivered hands-on. If on-prem is a hard requirement, talk to us before you sign.
Production dependencies are pinned. We scan continuously for known vulnerabilities and review upgrades before merging. The supply chain does not include Anthropic, OpenAI, or GPT family SDKs in any AI-serving path. Authentication, storage, and database layers are managed services with their own security postures published.
We respond to security reports within 24 hours. We treat every report seriously, regardless of severity. We do not pursue legal action against good-faith researchers who follow responsible disclosure, and we credit contributors who ask to be credited.
Email security@terrabrains.ai with a description of the issue, the steps to reproduce it, and the impact you observed. We acknowledge inside one business day, give you a fix timeline inside three, and credit you publicly when the fix ships if you ask to be credited.